Data protection law in the UK, comprising principally of the GDPR and the
Data Protection Act 2018, provides a range of rights for individuals (“data
subjects”) designed to help protect their personal data as well as their
own rights, interests, and freedoms.
This letter includes options for different scenarios where a longer
response time is required. Ordinarily, you must respond to a request from a
data subject to exercise their rights within one month. In some cases,
however, particularly where a request is complex (or numerous), this can be
extended by up to two months.
There are four main scenarios in which this letter can be used:
1. Where it is clear from the outset that it will take longer to respond;
2. Where you initially responded to the individual and informed them that
you would respond to their request within one month but, on further
consideration of their request, need more time;
3. Where you requested confirmation of an individual’s identity and now,
having received it, have determined that you will need more time;
4. Where you requested a fee (for a manifestly unfounded or excessive request) and now, having received it, have determined
that you will need more time.
Where you do not need longer than the standard month to respond, please use
the other letters available in this subfolder.
Optional phrases / clauses are enclosed in square brackets. These should be
read carefully and selected so as to be compatible with one another. Unused
options should be removed from the document.
Once you have purchased access to the appropriate document folder click on
the “Download Document” link below. You will be asked what you want to do
with the file. It is recommended that you save the document to a location
of your choice prior to viewing.